6725b56311e572d70e7608ef6a0951224d099a168d404017edd77f2db039909d

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01011ff0bef706ad5c3c30437c7fcfba_JaffaCakes118.html
Size

35KB
MD5

01011ff0bef706ad5c3c30437c7fcfba
SHA1

5021ea412161f08d1c83db5c9f5f3aa2ff812420
SHA256

6725b56311e572d70e7608ef6a0951224d099a168d404017edd77f2db039909d
SHA512

77f237993f0a0d40d31fe2f8ae683a46809ae6174c1d7aa579c30f746028f6b0d488565d86aa5d7edf845e29a8235bbb58e16797552e072e7e839c393bdef310
SSDEEP

768:zwx/MDTHik88hARRZPXIE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TUZOD6DJtxo6lLi:Q/XbJxNVru0S9/p8pK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
456	msedge.exe
456	msedge.exe
4336	identity_helper.exe
4336	identity_helper.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 1208	456	msedge.exe	84
PID 456 wrote to memory of 1208	456	msedge.exe	84
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 2064	456	msedge.exe	85
PID 456 wrote to memory of 4672	456	msedge.exe	86
PID 456 wrote to memory of 4672	456	msedge.exe	86
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87
PID 456 wrote to memory of 4916	456	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\01011ff0bef706ad5c3c30437c7fcfba_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8299e46f8,0x7ff8299e4708,0x7ff8299e4718
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,611492682312331161,15467879108198656092,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83e531a486a91eac7d5f77580a1d51f4

SHA1
0bb37396b451b92fc4f39f534dab8233476450a9

SHA256
725de9d8e9913642e9c7a3a1cf412eb47fb4e281da0a05a769058a42f4987e4a

SHA512
b45040014fae7bcc9630e43bbe6e52301bf16062e847a86cf5615ecc0b1df9ad3b68df5202254bb150b03e890fa7e0d453c497aa8b50f2192ed5ac514b9ef3f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d150dc19365e1859dd4366686e4d07e

SHA1
6a63a6c876b3c0fa74ad751e37c50d0dddc6d930

SHA256
51f9dd4f70fb7458eb91c7b41b45826e13414075380d6a04323f53a932d80b25

SHA512
74193e31b6fcb805fc0d0cec7099c495037756091130e7d4b371e1d68b45c3c1c9fb940e2c228b6afc67a58a2c93f79db4ebe35ab22b2315a198a09b5fb0b4d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
039d07d4055d5d15f56af9dafc1d5a15

SHA1
1abe0d6b0c738e4d800e1ad2fedfb17d56410681

SHA256
ef9121f7839b78391251567e0aafaeec2a4920262964b2d55a1e7ef9335896ad

SHA512
34d831e34598b00df638b8c170de0bd365d5276f775c22bd625971ca2da3d0dae346bfc4e431191e94b6b6b8ed0db96408a30e3d7560b5cf05203e7344e396e9

Download Submit